BadGraph: A Backdoor Attack Against Latent Diffusion Model for Text-Guided Graph Generation

TL;DR

BadGraph presents a black-box backdoor attack against latent diffusion models used for text-guided graph generation. By poisoning a subset of training data with a textual trigger and a attacker-designed target subgraph, the method enforces generation of the subgraph when the trigger appears, while preserving normal outputs otherwise. Experimental results across four datasets show strong attack effectiveness at moderate poisoning rates with minimal impact on benign prompts, and ablations localize the backdoor to the VAE and diffusion-training stages rather than representation alignment. This work highlights critical security risks in diffusion-based graph generation, motivating the development of defenses to safeguard downstream applications such as drug discovery.

Abstract

The rapid progress of graph generation has raised new security concerns, particularly regarding backdoor vulnerabilities. While prior work has explored backdoor attacks in image diffusion and unconditional graph generation, conditional, especially text-guided graph generation remains largely unexamined. This paper proposes BadGraph, a backdoor attack method against latent diffusion models for text-guided graph generation. BadGraph leverages textual triggers to poison training data, covertly implanting backdoors that induce attacker-specified subgraphs during inference when triggers appear, while preserving normal performance on clean inputs. Extensive experiments on four benchmark datasets (PubChem, ChEBI-20, PCDes, MoMu) demonstrate the effectiveness and stealth of the attack: less than 10% poisoning rate can achieves 50% attack success rate, while 24% suffices for over 80% success rate, with negligible performance degradation on benign samples. Ablation studies further reveal that the backdoor is implanted during VAE and diffusion training rather than pretraining. These findings reveal the security vulnerabilities in latent diffusion models of text-guided graph generation, highlight the serious risks in models' applications such as drug discovery and underscore the need for robust defenses against the backdoor attack in such diffusion models.

Figures (7)

• Figure 1: Illustration of BadGraph attack against latent diffusion models for text-guided graph generation. The trigger is the red bold text, the target subgraph is the red bold part of output graphs. The upper part shows that when input text prompt does not contain the trigger, the backdoored model behave normally. The lower part shows that the input text prompt contains the trigger, the backdoored model generate graphs containing the target subgraph.
• Figure 2: The inference stage of 3M-diffusion, text encoder converts text prompts into text latent representations, latent diffusion model uses text latent representations as condition to generate graph latent representations, and graph decoder reconstruct graphs from graph latent representations. Text encoder and graph encoder is aligned in Representation Alignment stage, graph encoder and decoder is jointly trained in VAE Training stage, and latent diffusion model is trained in the Diffusion Training stage.
• Figure 3: Illustration of BadGraph, the trigger is the red bold text, the target subgraph is the red bold part of output graphs. The backdoor attack consists of four steps, 1. The attacker select the trigger and target subgraph; 2. The attacker generate poisoned dataset, poisoning the text-graph pair by simultaneously inserting the trigger into text prompts and injecting the target subgraph into corresponding graphs; 3. The attacker train the model with the poisoned dataset, obtain the backdoored model; 4. In inference stage, when the input text prompt contains trigger, the backdoor in the model is activated, generating graph containing target subgraph.
• Figure 4: Ethylene-sulfide complete diagram (left) and simple diagram (right)
• Figure 5: Attack success rate (ASR) of different poisoning rates across four datasets.